@geekmidas/cli 10.0.0-alpha.21 → 10.0.0-alpha.22

package/dist/index.mjs

@@ -2,24 +2,24 @@
 import { n as __require, t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { i as DEFAULT_CACHE, r as ConstructGenerator, s as isPartitionedRoutes, t as discover } from "./discover-CK-n3w6b.mjs";
 import { i as loadConfig, l as derivedApps, n as getAppNameFromCwd, o as loadWorkspaceConfig, r as loadAppConfig, s as parseModuleConfig } from "./config-DdKkoUE1.mjs";
-import { A as stripPublicPrefix, C as InvalidStages, D as stageProblems, E as deployedProblems, T as assertDeployedStage, a as getAppBuildOrder, k as getPublicEnvPrefix, o as getAppGkmConfig, s as getDependencyEnvVars, t as allConstructGlobs, v as getDeployTargetError, y as isDeployTargetSupported } from "./workspace-Bu3xNCej.mjs";
-import { C as storageBackendFor, S as providerOf, _ as LOCAL_CA_PATH, a as loadEnvFiles, b as cacheBackendFor, c as resolveServicePorts, d as constructGlobs, f as derivedContainers, g as COMPOSE_PATH, i as isPortAvailable, l as rewriteUrlsWithPorts, m as usesConstructs, n as createEntryWrapper, o as loadSecretsForApp, p as reconcileWorkspace, r as findAvailablePort, s as prepareEntryCredentials, t as createCredentialsPreload, u as startWorkspaceServices, v as applyPostgres, x as eventsBackendFor, y as resourceName } from "./credentials-CD8ftUS6.mjs";
+import { A as stripPublicPrefix, C as InvalidStages, D as stageProblems, E as deployedProblems, T as assertDeployedStage, a as getAppBuildOrder, k as getPublicEnvPrefix, o as getAppGkmConfig, s as getDependencyEnvVars, t as allConstructGlobs, v as getDeployTargetError, w as TEST_STAGE, y as isDeployTargetSupported } from "./workspace-Bu3xNCej.mjs";
+import { C as providerOf, S as eventsBackendFor, _ as COMPOSE_PATH, a as loadEnvFiles, b as resourceName, c as resolveServicePorts, d as backendsOf, f as constructGlobs, h as usesConstructs, i as isPortAvailable, l as rewriteUrlsWithPorts, m as reconcileWorkspace, n as createEntryWrapper, o as loadSecretsForApp, p as derivedContainers, r as findAvailablePort, s as prepareEntryCredentials, t as createCredentialsPreload, u as startWorkspaceServices, v as LOCAL_CA_PATH, w as storageBackendFor, x as cacheBackendFor, y as applyPostgres } from "./credentials-D9TKJJZc.mjs";
 import { a as generateServiceCredentials, i as generateSecurePassword, n as generateConnectionUrls, o as rotateServicePassword, t as createStageSecrets } from "./generator-LfZU7NlU.mjs";
 import { c as getKeyPath, i as setCustomSecret, n as readStageSecrets, o as toEmbeddableSecrets, r as secretsExist, s as writeStageSecrets, t as maskPassword } from "./storage-TP0x118M.mjs";
-import { a as openapiCommand, c as runtimeFor, n as generateOpenApi, o as resolveOpenApiConfig, r as generateOpenApiFrom, s as EndpointGenerator, t as OPENAPI_OUTPUT_PATH$1 } from "./openapi-DfjbhrsM.mjs";
+import { a as openapiCommand, c as EndpointGenerator, l as runtimeFor, n as generateOpenApi, o as resolveOpenApiConfig, r as generateOpenApiFrom, s as OpenApiTsGenerator, t as OPENAPI_OUTPUT_PATH$1 } from "./openapi-B5PSuLym.mjs";
 import { i as withRoutes, r as withCompute } from "./emit-Bzq7JsMP.mjs";
 import { i as writeDockerEnvFromSecrets, r as generateFullstackCustomSecrets } from "./reconcile-gb1lz1Dk.mjs";
-import { a as isRemoteStore, n as pullStageSecrets, r as pushStageSecrets, t as NoStoredSecrets } from "./transfer-Gsxfy6m-.mjs";
+import { a as isRemoteStore, n as pullStageSecrets, r as pushStageSecrets, t as NoStoredSecrets } from "./transfer-Bk5YlRyB.mjs";
 import { createRequire } from "node:module";
 import { Command } from "commander";
 import { stdin, stdout } from "node:process";
 import * as readline from "node:readline/promises";
 import { copyFileSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { basename, dirname, isAbsolute, join, parse, relative, resolve } from "node:path";
 import { execFile, execSync, spawn } from "node:child_process";
-import { cacheTable, canonicalId, cloudName, cookieDomain, dependentsOf, provideKey, provisionOrder, scopedName, serviceKey } from "@geekmidas/manifest";
+import { cacheTable, canonicalId, cloudName, cookieDomain, dependentsOf, kebabCase, provideKey, provisionOrder, scopedName, serviceKey } from "@geekmidas/manifest";
 import fg from "fast-glob";
 import chokidar from "chokidar";
 import { parse as parse$1, parseDocument } from "yaml";
@@ -36,8 +36,10 @@ import { Topic } from "@geekmidas/constructs/topic";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { lookup } from "node:dns/promises";
 import prompts from "prompts";
+import { EnvironmentParser } from "@geekmidas/envkit";
+import { serviceContext } from "@geekmidas/services";
 //#region package.json
-var version = "10.0.0-alpha.21";
+var version = "10.0.0-alpha.22";
 //#endregion
 //#region src/auth/credentials.ts
 /**
@@ -8407,26 +8409,26 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.21",
-	"@geekmidas/auth": "~10.0.0-alpha.21",
-	"@geekmidas/cache": "~10.0.0-alpha.21",
-	"@geekmidas/client": "~10.0.0-alpha.21",
-	"@geekmidas/cloud": "~10.0.0-alpha.21",
-	"@geekmidas/constructs": "~10.0.0-alpha.21",
-	"@geekmidas/db": "~10.0.0-alpha.21",
-	"@geekmidas/emailkit": "~10.0.0-alpha.21",
-	"@geekmidas/envkit": "~10.0.0-alpha.21",
-	"@geekmidas/errors": "~10.0.0-alpha.21",
-	"@geekmidas/events": "~10.0.0-alpha.21",
-	"@geekmidas/logger": "~10.0.0-alpha.21",
-	"@geekmidas/manifest": "~10.0.0-alpha.21",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.21",
-	"@geekmidas/schema": "~10.0.0-alpha.21",
-	"@geekmidas/services": "~10.0.0-alpha.21",
-	"@geekmidas/storage": "~10.0.0-alpha.21",
-	"@geekmidas/studio": "~10.0.0-alpha.21",
-	"@geekmidas/telescope": "~10.0.0-alpha.21",
-	"@geekmidas/testkit": "~10.0.0-alpha.21",
+	"@geekmidas/audit": "~10.0.0-alpha.22",
+	"@geekmidas/auth": "~10.0.0-alpha.22",
+	"@geekmidas/cache": "~10.0.0-alpha.22",
+	"@geekmidas/client": "~10.0.0-alpha.22",
+	"@geekmidas/cloud": "~10.0.0-alpha.22",
+	"@geekmidas/constructs": "~10.0.0-alpha.22",
+	"@geekmidas/db": "~10.0.0-alpha.22",
+	"@geekmidas/emailkit": "~10.0.0-alpha.22",
+	"@geekmidas/envkit": "~10.0.0-alpha.22",
+	"@geekmidas/errors": "~10.0.0-alpha.22",
+	"@geekmidas/events": "~10.0.0-alpha.22",
+	"@geekmidas/logger": "~10.0.0-alpha.22",
+	"@geekmidas/manifest": "~10.0.0-alpha.22",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.22",
+	"@geekmidas/schema": "~10.0.0-alpha.22",
+	"@geekmidas/services": "~10.0.0-alpha.22",
+	"@geekmidas/storage": "~10.0.0-alpha.22",
+	"@geekmidas/studio": "~10.0.0-alpha.22",
+	"@geekmidas/telescope": "~10.0.0-alpha.22",
+	"@geekmidas/testkit": "~10.0.0-alpha.22",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -15127,6 +15129,223 @@ function printSummary(workspace, stage) {
 	logger$1.log("");
 }
 //#endregion
+//#region src/test/harness.ts
+/**
+* What `gkm test` writes for a feature test to be built from.
+*
+* `gkm test` already discovers an app's constructs and resolves the test
+* stage's environment; this keeps both, under `.gkm/test/`:
+*
+* - `manifest.json` — which construct and endpoint is exported where, and the
+*   environment the test stage resolved, keyed as the constructs derive keys.
+* - `clients/<surface>.ts` — each surface's typed client, from the same
+*   generator `gkm build` uses for the app's own.
+* - `index.ts` — the configured `it`, and a `Browser` holding one client per
+*   surface and one per auth server, each on the browser's `fetch`.
+*
+* A test imports `it` from there and declares nothing — not a construct, not an
+* environment key, not a client.
+*/
+/**
+* The variable the manifest's path travels in — what
+* `@geekmidas/constructs/testing` reads. Its own constant rather than an import:
+* that entry carries the whole harness (MSW, Hono, Vitest), and importing it
+* here put all of it on the start-up path of every `gkm` command.
+*/
+const TEST_MANIFEST_ENV = "GKM_TEST_MANIFEST";
+/** Where the harness lives, relative to the workspace root. */
+const TEST_HARNESS_DIR = ".gkm/test";
+/**
+* Better-auth's client plugin for each server plugin id.
+*
+* Written down rather than derived: the ids and the client names do not follow
+* one rule (`admin` pairs with `adminClient`, `email-otp` with
+* `emailOTPClient`), and a guess that missed would hand a test a client
+* silently lacking every method of that plugin. A server plugin not listed has
+* no client counterpart — `bearer`, `open-api` — or needs one from another
+* package, and is left out.
+*/
+const CLIENT_PLUGINS = {
+	admin: "adminClient",
+	anonymous: "anonymousClient",
+	"device-authorization": "deviceAuthorizationClient",
+	"email-otp": "emailOTPClient",
+	jwt: "jwtClient",
+	"last-login-method": "lastLoginMethodClient",
+	"magic-link": "magicLinkClient",
+	"multi-session": "multiSessionClient",
+	"oauth-popup": "oauthPopupClient",
+	"one-tap": "oneTapClient",
+	"one-time-token": "oneTimeTokenClient",
+	organization: "organizationClient",
+	"phone-number": "phoneNumberClient",
+	siwe: "siweClient",
+	"two-factor": "twoFactorClient",
+	username: "usernameClient"
+};
+/** Write the manifest, the clients and the harness; return the manifest path. */
+async function writeTestHarness(options) {
+	const sources = {};
+	const declared = await discover({
+		patterns: options.patterns,
+		cwd: options.root,
+		sources
+	});
+	const endpoints = (await new EndpointGenerator().load(options.patterns, options.root)).map(({ key, construct, path }) => ({
+		surface: construct.owner ?? construct.surface?.id,
+		construct,
+		source: {
+			file: path.absolute,
+			export: key
+		}
+	})).filter((endpoint) => endpoint.surface !== void 0);
+	const manifest = {
+		stage: options.stage,
+		constructs: Object.fromEntries(Object.entries(declared).flatMap(([id, declaration]) => {
+			const source = sources[id];
+			return source ? [[id, {
+				kind: declaration.kind,
+				source: {
+					file: source.file,
+					export: source.exportName
+				}
+			}]] : [];
+		})),
+		endpoints: endpoints.map(({ surface, source }) => ({
+			surface,
+			source
+		})),
+		env: options.env
+	};
+	const surfaces = [...new Set(endpoints.map(({ surface }) => surface))];
+	const generator = new OpenApiTsGenerator();
+	const clients = await Promise.all(surfaces.map(async (surface) => ({
+		file: `${kebabCase(surface)}.ts`,
+		content: await generator.generate(endpoints.filter((endpoint) => endpoint.surface === surface).map(({ construct }) => construct), {
+			title: surface,
+			version: "1.0.0"
+		})
+	})));
+	const auths = await authClients(declared, sources, options.env);
+	const drivers = driversFor({
+		appRoot: options.root,
+		cache: cacheBackendsIn(declared, options.cacheBackend)
+	});
+	const database = await databaseSource(declared, sources, endpoints.map(({ construct }) => construct));
+	const harnessFor = (dir) => harnessModule({
+		dir,
+		database,
+		surfaces: surfaces.map((id, index) => ({
+			id,
+			secured: clients[index].content.includes("authStrategies:")
+		})),
+		auths,
+		drivers
+	});
+	const json = `${JSON.stringify(manifest, null, 2)}\n`;
+	return (await Promise.all([...new Set(options.targets)].map(async (target) => {
+		const dir = join(target, TEST_HARNESS_DIR);
+		await rm(dir, {
+			recursive: true,
+			force: true
+		});
+		await mkdir(join(dir, "clients"), { recursive: true });
+		await writeFile(join(dir, "manifest.json"), json);
+		await writeFile(join(dir, "index.ts"), harnessFor(dir));
+		for (const client of clients) await writeFile(join(dir, "clients", client.file), client.content);
+		return join(dir, "manifest.json");
+	})))[0];
+}
+/** Each auth server, with the client plugins its server plugins pair with. */
+async function authClients(declared, sources, env) {
+	const clients = [];
+	const envParser = new EnvironmentParser({ ...env });
+	for (const [id, declaration] of Object.entries(declared)) {
+		const source = sources[id];
+		if (declaration.kind !== "rest-api" || !source) continue;
+		const exported = (await import(source.file))[source.exportName];
+		if (!isBetterAuth(exported) || exported.id !== id) continue;
+		const ids = await exported.pluginIds({
+			envParser,
+			context: serviceContext
+		});
+		clients.push({
+			id,
+			basePath: exported.basePath,
+			plugins: ids.flatMap((plugin) => CLIENT_PLUGINS[plugin] ?? [])
+		});
+	}
+	return clients;
+}
+function isBetterAuth(value) {
+	return typeof value === "object" && value !== null && "pluginIds" in value && "basePath" in value;
+}
+/** `Api` → `api`, `AdminApi` → `adminApi`: a construct id as a property name. */
+function propertyOf(id) {
+	return id.charAt(0).toLowerCase() + id.slice(1);
+}
+/**
+* The database a test's `db` is — the one the endpoints were given with
+* `.database()`, found by the service they hold, which is the construct's own.
+* The same rule `featureTest` applies at runtime, applied here so `db` can be
+* typed by the construct's schema.
+*/
+async function databaseSource(declared, sources, endpoints) {
+	const services = new Set(endpoints.map((endpoint) => endpoint.databaseService).filter(Boolean));
+	if (services.size === 0) return void 0;
+	for (const [id, declaration] of Object.entries(declared)) {
+		const source = sources[id];
+		if (!source || !declaration.kind.startsWith("database")) continue;
+		const exported = (await import(source.file))[source.exportName];
+		if (services.has(exported?.service)) return source;
+	}
+}
+/** An import specifier for `file`, from the harness written into `dir`. */
+function specifierFrom(dir, file) {
+	const path = relative(dir, file).replace(/\.tsx?$/, ".js");
+	return path.startsWith(".") ? path : `./${path}`;
+}
+function harnessModule(options) {
+	const { surfaces, auths, drivers, database, dir } = options;
+	const plugins = [...new Set(auths.flatMap(({ plugins }) => plugins))].sort();
+	const imports = [
+		`import {${database ? " type DatabaseOf," : ""} featureTest, loadTestManifest } from '@geekmidas/constructs/testing';`,
+		...database ? [`import type { ${database.exportName} as __database } from '${specifierFrom(dir, database.file)}';`] : [],
+		`import { Browser as TestBrowser } from '@geekmidas/testkit/browser';`,
+		...surfaces.map(({ id }) => `import { createApi as create${id} } from './clients/${kebabCase(id)}.js';`),
+		...auths.length ? [`import { createAuthClient } from 'better-auth/client';`] : [],
+		...plugins.length ? [`import { ${plugins.join(", ")} } from 'better-auth/client/plugins';`] : [],
+		...drivers.imports ? [drivers.imports] : []
+	];
+	const url = (id) => `manifest.env[${JSON.stringify(provideKey(id, "url"))}]!`;
+	const members = [...surfaces.map(({ id, secured }) => `	/** \`${id}\`, at ${provideKey(id, "url")}. */
+	readonly ${propertyOf(id)} = create${id}({
+		baseURL: ${url(id)},
+		fetch: this.fetch,${secured ? `
+		// Served in-process: no authorizer runs, so nothing is signed. A scheme
+		// with no strategy sends its request without credentials.
+		authStrategies: {} as never,` : ""}
+	});`), ...auths.map((auth) => `	/** \`${auth.id}\`, at ${provideKey(auth.id, "url")}. */
+	readonly ${propertyOf(auth.id)} = createAuthClient({
+		baseURL: \`\${${url(auth.id)}}${auth.basePath}\`,
+		plugins: [${auth.plugins.map((plugin) => `${plugin}()`).join(", ")}],
+		fetchOptions: { customFetchImpl: this.fetch },
+	});`)];
+	return `// Generated by \`gkm test\` from the app's constructs — do not edit.
+${imports.join("\n")}
+
+${drivers.setup ? `// The drivers the app's server entry registers, registered the same way.\n${drivers.setup}\n\n` : ""}const manifest = loadTestManifest(new URL('./manifest.json', import.meta.url));
+
+/** A browser with a client for every surface the app declares. */
+export class Browser extends TestBrowser {
+${members.join("\n\n")}
+}
+
+/** \`it\`, for a test that drives the app the way it runs deployed. */
+export const it = featureTest${database ? "<Browser, DatabaseOf<typeof __database>>" : ""}({ manifest, browser: Browser });
+`;
+}
+//#endregion
 //#region src/test/index.ts
 /**
 * Run tests with secrets, dependency URLs, and .env files loaded.
@@ -15145,7 +15364,7 @@ async function testCommand(options = {}) {
 	if (defaultEnv.loaded.length > 0) console.log(`  📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
 	const result = await prepareEntryCredentials({
 		stage,
-		startDocker: true,
+		startDocker: !options.prepare,
 		secretsFileName: "test-secrets.json",
 		resolveDockerPorts: "full",
 		reconcileStage: "test"
@@ -15167,6 +15386,19 @@ async function testCommand(options = {}) {
 	const gkmDir = join(cwd, ".gkm");
 	const preloadPath = join(gkmDir, "test-credentials-preload.ts");
 	await createCredentialsPreload(preloadPath, result.secretsJsonPath);
+	const workspace = await loadWorkspaceConfig(cwd).then((loaded) => loaded.workspace).catch(() => void 0);
+	const manifestPath = workspace && usesConstructs(workspace) ? await writeTestHarness({
+		root: workspace.root,
+		targets: [workspace.root, ...Object.values(workspace.apps).map((app) => isAbsolute(app.path) ? app.path : join(workspace.root, app.path))],
+		patterns: constructGlobs(workspace),
+		cacheBackend: backendsOf(workspace).cache,
+		stage: TEST_STAGE,
+		env: finalCredentials
+	}) : void 0;
+	if (options.prepare) {
+		console.log(manifestPath ? `  🧪 Test harness written beside ${manifestPath}` : "  🧪 Nothing to prepare: this project declares no constructs");
+		return;
+	}
 	const nodeOptions = [
 		process.env.NODE_OPTIONS ?? "",
 		"--import=tsx",
@@ -15184,6 +15416,7 @@ async function testCommand(options = {}) {
 		env: {
 			...process.env,
 			...finalCredentials,
+			...manifestPath ? { [TEST_MANIFEST_ENV]: manifestPath } : {},
 			NODE_ENV: "test",
 			NODE_OPTIONS: nodeOptions
 		}
@@ -15629,7 +15862,7 @@ program.command("exec").description("Run a command with secrets injected into Cr
 		process.exit(1);
 	}
 });
-program.command("test").description("Run tests with secrets loaded from environment").option("--stage <stage>", "Stage to load secrets from (default: stages.local)").option("--run", "Run tests once without watch mode").option("--watch", "Enable watch mode").option("--coverage", "Generate coverage report").option("--ui", "Open Vitest UI").option("--auto-setup", "Generate a fresh stage (secrets + key) from the workspace config when none exists (for CI; also via GKM_AUTO_SETUP)").argument("[pattern]", "Pattern to filter tests").action(async (pattern, options) => {
+program.command("test").description("Run tests with secrets loaded from environment").option("--stage <stage>", "Stage to load secrets from (default: stages.local)").option("--run", "Run tests once without watch mode").option("--watch", "Enable watch mode").option("--coverage", "Generate coverage report").option("--ui", "Open Vitest UI").option("--auto-setup", "Generate a fresh stage (secrets + key) from the workspace config when none exists (for CI; also via GKM_AUTO_SETUP)").option("--prepare", "Write the test manifest and #test harness, then stop — for a typecheck that runs before the suite").argument("[pattern]", "Pattern to filter tests").action(async (pattern, options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -15761,7 +15994,7 @@ program.command("secrets:push").description("Send a deployed stage's secrets to
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
-		const { pushStageSecrets } = await import("./transfer-Gsxfy6m-.mjs").then((n) => n.i);
+		const { pushStageSecrets } = await import("./transfer-Bk5YlRyB.mjs").then((n) => n.i);
 		const { workspace } = await loadWorkspaceConfig();
 		const { addedKeys } = await pushStageSecrets(workspace, options.stage, { profile: options.profile });
 		for (const key of addedKeys) console.log(`  + ${key} (reconciled)`);
@@ -15776,7 +16009,7 @@ program.command("secrets:pull").description("Bring a deployed stage's secrets fr
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
-		const { pullStageSecrets } = await import("./transfer-Gsxfy6m-.mjs").then((n) => n.i);
+		const { pullStageSecrets } = await import("./transfer-Bk5YlRyB.mjs").then((n) => n.i);
 		const { workspace } = await loadWorkspaceConfig();
 		const { addedKeys } = await pullStageSecrets(workspace, options.stage, { profile: options.profile });
 		for (const key of addedKeys) console.log(`  + ${key} (reconciled)`);
@@ -15800,7 +16033,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await import("./credentials-CD8ftUS6.mjs").then((n) => n.h);
+		const { derivedContainers } = await import("./credentials-D9TKJJZc.mjs").then((n) => n.g);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -15859,7 +16092,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await import("./github-De-yMwVt.mjs");
+		const { deployGithubCommand } = await import("./github-B4OQQZBV.mjs");
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));